easy-hotel / admin / includes / post-types / init.php

init.php in Easy Hotel – Powerful Hotel Booking trunk, at admin/includes/post-types/init.php

165 lines 6.0 KB

Raw Download Zip

1	<?php
2	if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
3	// custom validation filter
4	function eshb_validate_for_required ( $value ) {
5	// return error message if empty
6	if ( empty( $value ) ) {
7	return esc_html__( 'This field is required.', 'easy-hotel' );
8	}
9	};
10
11	/**
12	* Required validation for the customer State field.
13	*
14	* State is only demanded when the chosen country actually has states to offer.
15	* Countries such as American Samoa carry an empty states list, so their State
16	* dropdown holds nothing but its placeholder and the plain required check would
17	* reject a save nobody could ever fix.
18	*
19	* @param string $value Posted state.
20	* @return string\|void Error message when the field is genuinely missing.
21	*/
22	function eshb_validate_state_for_required ( $value ) {
23
24	if ( ! empty( $value ) ) {
25	return;
26	}
27
28	$country = '';
29	$uniques = array(
30	'eshb_booking_customer_details_metaboxes',
31	'eshb_payment_customer_details_metaboxes',
32	);
33
34	// The metabox verified its own nonce before handing the value over here.
35	foreach ( $uniques as $unique ) {
36	if ( isset( $_POST[ $unique ]['country'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
37	$country = sanitize_text_field( wp_unslash( $_POST[ $unique ]['country'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
38	break;
39	}
40	}
41
42	if ( '' !== $country && ! ESHB_Helper::eshb_country_has_states( $country ) ) {
43	return;
44	}
45
46	return esc_html__( 'This field is required.', 'easy-hotel' );
47
48	};
49
50	/**
51	* Post types whose title is filtered through wp_kses_post().
52	*
53	* eshb_accomodation is on the list because its title is printed with
54	* wp_kses_post() by the room grid/slider widgets and blocks, so this filter
55	* is what keeps that output safe.
56	*
57	* @return string[]
58	*/
59	function eshb_title_guarded_post_types() {
60	return apply_filters( 'eshb_title_guarded_post_types', array(
61	'eshb_accomodation',
62	'eshb_coupon',
63	'eshb_service',
64	'eshb_session',
65	'eshb_booking_request',
66	) );
67	}
68
69	/**
70	* Allow formatting markup in a title, drop everything that can execute.
71	*
72	* Titles are deliberately NOT reduced to plain text: shop owners style them
73	* with <strong>, <em>, <span> and the like, and esc_html()/wp_strip_all_tags()
74	* would either print those tags literally or throw the formatting away.
75	* wp_kses_post() keeps the post-content tag whitelist and removes <script>,
76	* <iframe>, on* event attributes and javascript: URLs.
77	*
78	* @param string $title Raw title.
79	* @return string
80	*/
81	function eshb_clean_post_title( $title ) {
82	return trim( wp_kses_post( (string) $title ) );
83	}
84
85	/**
86	* Filter the guarded post titles on save.
87	*
88	* Administrators and editors hold the `unfiltered_html` capability, so
89	* WordPress stores whatever they type in the title field verbatim —
90	* including a <script> tag. These titles are printed as markup in the room
91	* widgets, the dashboard, the checkout and notification e-mails, so the
92	* dangerous parts are removed before they ever reach the database while the
93	* formatting tags survive.
94	*
95	* wp_insert_post_data covers every write path: the classic editor, the
96	* block editor, quick edit, the REST API and programmatic
97	* wp_insert_post()/wp_update_post() calls.
98	*
99	* @param array $data Sanitized post data headed for the database.
100	* @return array
101	*/
102	function eshb_sanitize_post_title_on_save( $data ) {
103
104	if ( ! isset( $data['post_type'], $data['post_title'] ) ) {
105	return $data;
106	}
107
108	if ( ! in_array( $data['post_type'], eshb_title_guarded_post_types(), true ) ) {
109	return $data;
110	}
111
112	$data['post_title'] = eshb_clean_post_title( $data['post_title'] );
113
114	return $data;
115	}
116	add_filter( 'wp_insert_post_data', 'eshb_sanitize_post_title_on_save', 99 );
117
118	/**
119	* Apply the same filtering on read, so titles that were stored before the
120	* save filter existed cannot fire a script either.
121	*
122	* @param string $title Post title.
123	* @param int\|null $post_id Post the title belongs to.
124	* @return string
125	*/
126	function eshb_sanitize_post_title_on_output( $title, $post_id = null ) {
127
128	if ( ! $post_id ) {
129	return $title;
130	}
131
132	if ( ! in_array( get_post_type( $post_id ), eshb_title_guarded_post_types(), true ) ) {
133	return $title;
134	}
135
136	return eshb_clean_post_title( $title );
137	}
138	add_filter( 'the_title', 'eshb_sanitize_post_title_on_output', 10, 2 );
139
140	include 'accomodation/accomodation.php';
141	include 'session/session.php';
142	include 'service/service.php';
143	include 'booking/booking.php';
144	include 'coupon/coupon.php';
145	include 'booking-request/booking-request.php';
146	include 'payment/payment.php';
147
148
149	add_action( 'plugins_loaded', function(){
150
151
152	// add nonce param to edit url
153	add_filter( 'get_edit_post_link', function( $link, $post_id, $context ) {
154
155	// Check for your custom post type (optional)
156	if ( in_array(get_post_type( $post_id ), ['eshb_booking', 'eshb_payment', 'eshb_coupon', 'eshb_booking_request', 'eshb_service', 'eshb_session']) ) {
157	// Add your custom parameter
158	$nonce_action = ESHB_Helper::generate_secure_nonce_action('eshb_global_nonce_action');
159	$link = add_query_arg( 'nonce', wp_create_nonce($nonce_action), $link );
160	}
161
162	return $link;
163	}, 10, 3 );
164	} );
165